gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Test: Harden compose secret fixtures

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-26 22:38:00 -04:00
parent 37fd5e890e
commit 6a7bdcb835
6 changed files with 54 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/server/scan-tracked-secrets.py
+21 -8
View File
@@ -16,11 +16,14 @@ from typing import Iterable
ENV_FILENAMES = {".env", ".env.example"}
YAML_SUFFIXES = {".yaml", ".yml"}
IGNORED_KEY_SUFFIXES = ("_FILE", "_PATH", "_NAME", "_KEY_NAME")
SECRET_KEY_PARTS = ("PASSWORD", "SECRET", "TOKEN", "API_KEY", "PRIVATE_KEY", "ACCESS_KEY")
CREDENTIAL_SEGMENTS = {"PASSWORD", "SECRET", "TOKEN"}
CREDENTIAL_KEY_SHAPES = (("API", "KEY"), ("PRIVATE", "KEY"), ("ACCESS", "KEY"))
BOOLEAN_VALUES = {"true", "false", "yes", "no", "0", "1"}
ENV_ASSIGNMENT = re.compile(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$")
YAML_MAPPING = re.compile(r"^(\s*)([A-Za-z_][A-Za-z0-9_.-]*)\s*:\s*(.*?)\s*$")
YAML_ENV_ITEM = re.compile(r"^(\s*)-\s+([A-Za-z_][A-Za-z0-9_]*)=(.*?)\s*$")
YAML_MAPPING = re.compile(
r"^(\s*)(?:\"([A-Za-z_][A-Za-z0-9_.-]*)\"|'([A-Za-z_][A-Za-z0-9_.-]*)'|([A-Za-z_][A-Za-z0-9_.-]*))\s*:\s*(.*?)\s*$"
)
YAML_ENV_ITEM = re.compile(r"^(\s*)-\s+(.*?)\s*$")
PRIVATE_KEY_HEADER = re.compile(r"BEGIN [A-Z ]*PRIVATE KEY")
PROVIDER_TOKEN = re.compile(r"sk-ant-[A-Za-z0-9]|ghp_[A-Za-z0-9]{20}|xox[baprs]-[A-Za-z0-9]")
@@ -58,7 +61,14 @@ def is_secret_key(key: str) -> bool:
normalized = key.upper()
if normalized.endswith(IGNORED_KEY_SUFFIXES):
return False
return any(part in normalized for part in SECRET_KEY_PARTS)
segments = tuple(segment for segment in re.split(r"[_.-]+", normalized) if segment)
if any(segment in CREDENTIAL_SEGMENTS for segment in segments):
return True
return any(
segments[index : index + len(shape)] == shape
for shape in CREDENTIAL_KEY_SHAPES
for index in range(len(segments) - len(shape) + 1)
)
def is_placeholder(value: str) -> bool:
@@ -93,15 +103,18 @@ def semantic_findings(path: str, content: str) -> Iterable[str]:
environment_indents = [depth for depth in environment_indents if indent > depth]
if mapping:
key, value = mapping.group(2), mapping.group(3)
key = mapping.group(2) or mapping.group(3) or mapping.group(4)
value = mapping.group(5)
if key.lower() == "environment" and not value.strip():
environment_indents.append(indent)
if is_secret_key(key) and not is_placeholder(value):
yield f"{path}:{line_number}: {key}"
elif item and environment_indents:
key, value = item.group(2), item.group(3)
if is_secret_key(key) and not is_placeholder(value):
yield f"{path}:{line_number}: {key}"
assignment = ENV_ASSIGNMENT.match(normalize_value(item.group(2)))
if assignment:
key, value = assignment.groups()
if is_secret_key(key) and not is_placeholder(value):
yield f"{path}:{line_number}: {key}"
def signature_findings(path: str, content: str) -> Iterable[str]: